Accept a 4-digit PIN. Allow up to 3 attempts. Lock the card after 3 failures. Display masked card number (only last 4 digits visible) for security.